ci: run code and security checks on RC pushes

.github/workflows/ci.yml

@@ -11,7 +11,7 @@ on:
   merge_group:
     types: [checks_requested]
   push:
-    branches: [main, "release/**"]
+    branches: [main, RC, "release/**"]
 
 concurrency:
   group: ci-${{ github.ref }}

.github/workflows/codeql.yml

@@ -5,7 +5,7 @@ name: CodeQL
 
 on:
   push:
-    branches: [main, "release/**"]
+    branches: [main, RC, "release/**"]
   pull_request:
     branches: [main, RC, "release/**"]
   merge_group:

.github/workflows/gitleaks.yml

@@ -8,7 +8,7 @@ on:
   merge_group:
     types: [checks_requested]
   push:
-    branches: [main, "release/**"]
+    branches: [main, RC, "release/**"]
 
 permissions:
   contents: read

scripts/rc-workflows.test.ts

@@ -0,0 +1,21 @@
+// SPDX-FileCopyrightText: 2026 VishnuM049
+// SPDX-License-Identifier: Apache-2.0
+
+import assert from "node:assert/strict";
+import { readFileSync } from "node:fs";
+import test from "node:test";
+
+for (const workflow of ["ci.yml", "codeql.yml", "gitleaks.yml"]) {
+  test(`${workflow} checks every RC push`, () => {
+    const source = readFileSync(
+      new URL(`../.github/workflows/${workflow}`, import.meta.url),
+      "utf8",
+    );
+    const branches = source.match(/^ {2}push:\r?\n {4}branches: \[([^\]]+)\]/m)?.[1];
+    assert.ok(branches, `${workflow} must declare push branches`);
+    assert.ok(
+      branches.split(",").some((branch) => branch.trim().replace(/^['"]|['"]$/g, "") === "RC"),
+      `${workflow} must run on RC pushes`,
+    );
+  });
+}